Incident prediction and response using deep learning techniques and multimodal data

ABSTRACT

In an approach to incident prediction and response, one or more computer processors receive one or more alerts corresponding to an incident. The one or more computer processors aggregate the one or more alerts with additional data corresponding to the incident. The one or more computer processors feed the aggregated data into a prediction model, where training of the prediction model uses associated independent stacked Restricted Boltzmann Machines utilizing one or more supervised methods and one or more unsupervised methods. The one or more computer processors determine, based, at least in part, on one or more calculations by the prediction model, at least one probability of the incident. The one or more computer processors determine whether the at least one probability exceeds a pre-defined threshold. In response to determining the at least one probability exceeds a pre-defined threshold, the one or more computer processors send at least one notification.

BACKGROUND OF THE INVENTION

The present invention relates generally to the field of machinelearning, and more particularly to predicting and responding to anincident using deep learning techniques and multimodal data.

Deep learning is a branch of machine learning based on a set ofalgorithms that model high-level abstractions in data by using modelarchitectures, with complex structures or otherwise, often composed ofmultiple non-linear transformations. Deep learning is part of a broaderfamily of machine learning methods based on learning representations ofdata. An observation (e.g., an image) can be represented in many wayssuch as a vector of intensity values per pixel, or in a more abstractway as a set of edges, regions of particular shape, etc. Somerepresentations make it easier to learn tasks (e.g., face recognition orfacial expression recognition) from examples. Deep learning algorithmsoften use a cascade of many layers of nonlinear processing units forfeature extraction and transformation. Each successive layer uses theoutput from the previous layer as input. The algorithms may besupervised or unsupervised, and applications include pattern analysis(unsupervised) and classification (supervised).

An artificial neural network, often called an artificial neural net orneural net, is used in many applications to recognize a pattern or afunction for which the neural net has been trained to recognize. Anartificial neural network is a lattice of individual artificial neuronsthat are connected to each other. The artificial neurons are oftenarranged in layers in a lattice with the outputs of the neurons in alayer connected to the inputs of the neurons in a next layer. Anartificial neuron is modeled on a biological neuron, which is comprisedof dendrites that carry input signals (often originating in the outputsof other neurons) to a cell body that processes the inputs and producesan output signal on an axon. The signal on the axon is often an input toone or more synapses that each provide a connection to one or moredendrites (inputs) on other neurons.

A Restricted Boltzmann Machine (RBM) is a generative stochasticartificial neural network that can learn a probability distribution overits set of inputs. An RBM can be trained in either supervised orunsupervised ways, depending on the task. As the name implies, RBMs area variant of Boltzmann machines, with the restriction that their neuronsmust form a bipartite graph: a pair of nodes from each of the two groupsof units, commonly referred to as the “visible” and “hidden” units,respectively, may have a symmetric connection between them, and thereare no connections between nodes within a group, i.e., connections onlyexist between the visible units of the input layer and the hidden unitsof the hidden layer; there are no visible-visible or hidden-hiddenconnections.

Once an RBM is trained, another RBM can be “stacked” atop of it tocreate a multilayer model. Each time another RBM is stacked, the inputvisible layer is initialized to a training vector, and values for theunits in the already-trained RBM layers are assigned using the currentweights and biases. The final layer of the already-trained layers isused as input to the new RBM. The new RBM is then trained with theprocedure above, and the process can be repeated until some desiredstopping criterion is met.

When a critical incident, such as a crime or a natural disaster, isabout to occur, gathering data that could potentially prevent tangibleand intangible damages or losses can be crucial. Data from staticsensors, such as security monitors and motion sensors, may be available,but may also be limited in scope due to the expense of placing a numberof sensors in close proximity to each other. Crowdsourcing is anothermethod of producing data regarding a critical incident. Crowdsourcingcan be defined as the process of obtaining needed services, ideas, orcontent by soliciting contributions from a large group of people, andespecially from an online community. A request for data regarding theincident may be sent directly to devices in the vicinity of apotentially critical incident. In addition, data can be gleaned frompostings on social networks. Data received from people, either viacrowdsourcing or social networks, may, however, be unreliable, dependingon a person's point of view. Data received from public officials, suchas police and firefighters, is generally reliable, however, due to thesmall number of officials in the vicinity, the data is likely to belimited. There is a need for a cognitive system that can gather dataregarding a potential critical incident from a plurality of sources,determine the probability that the incident will occur (or isoccurring), and notify stakeholders, such as officials and bystanders,with information and instructions in order to minimize tangible andintangible damages.

SUMMARY

A first aspect of the present invention discloses a method including oneor more computer processors receiving one or more alerts correspondingto an incident. The one or more computer processors aggregate the one ormore alerts with additional data corresponding to the incident. The oneor more computer processors feed the aggregated data into a predictionmodel, where training of the prediction model uses associatedindependent stacked Restricted Boltzmann Machines utilizing one or moresupervised methods and one or more unsupervised methods. The one or morecomputer processors determine, based, at least in part, on one or morecalculations by the prediction model, at least one probability of theincident. The one or more computer processors determine whether the atleast one probability exceeds a pre-defined threshold. In response todetermining the at least one probability exceeds a pre-definedthreshold, the one or more computer processors send at least onenotification.

A second aspect of the present invention discloses a computer programproduct including one or more computer readable storage device andprogram instructions stored on the one or more computer readable storagedevice. The stored program instructions include program instructions toreceive one or more alerts corresponding to an incident. The storedprogram instructions include program instructions to aggregate the oneor more alerts with additional data corresponding to the incident. Thestored program instructions include program instructions to feed theaggregated data into a prediction model, where training of theprediction model uses associated independent stacked RestrictedBoltzmann Machines utilizing one or more supervised methods and one ormore unsupervised methods. The stored program instructions includeprogram instructions to determine, based, at least in part, on one ormore calculations by the prediction model, at least one probability ofthe incident. The stored program instructions include programinstructions to determine whether the at least one probability exceeds apre-defined threshold. In response to determining the at least oneprobability exceeds a pre-defined threshold, the stored programinstructions include program instructions to send at least onenotification.

A third aspect of the present invention discloses a computer systemincluding one or more computer processors and one or more computerreadable storage device, where the program instructions are stored onthe one or more computer readable storage device for execution by atleast one of the one or more computer processors. The stored programinstructions include program instructions to determine, based, at leastin part, on one or more calculations by the prediction model, at leastone probability of the incident. The stored program instructions includeprogram instructions to determine whether the at least one probabilityexceeds a pre-defined threshold. In response to determining the at leastone probability exceeds a pre-defined threshold, the stored programinstructions include program instructions to send at least onenotification.

In another aspect, training the prediction model includes passing, byone or more computer processors, an object vector to a RestrictedBoltzmann Machine (RBM), training, by the one or more computerprocessors, the RBM with one or more supervised methods or with one ormore unsupervised methods, and placing, by the one or more computerprocessors, the trained RBM in one or more stacks of trained RBMs.Training the prediction model also includes determining, by the one ormore computer processors, whether passing data through the one or morestacks of RBMs creates a desired recall, creating, by the one or morecomputer processors, one or more associative layers of stacked RBMs, andperforming, by the one or more computer processors, supervised trainingon the one or more associative layers. Training the RBM with asupervised method is advantageous because a supervised learningalgorithm analyzes the training data and produces an inferred function,which can be used for mapping new examples. Training the RBM with anunsupervised method is advantageous for use in model training when theonly data available is unlabeled data.

In yet another aspect, training the RBM with one or more supervisedmethods or with one or more unsupervised methods includes determining,by one or more computer processors, whether a chronological order of theRBM is odd or even. In response to determining the chronological orderof the RBM is even, training, by the one or more computer processors,the RBM with one or more supervised methods, and in response todetermining the chronological order of the RBM is odd, training, by theone or more computer processors, the RBM with one or more unsupervisedmethods. It is advantageous to determine whether the RBM is odd or evenin order to equally integrate the training with both supervised andunsupervised methods.

In yet another aspect, placing the trained RBM in one or more stacksincludes creating, by the one or more computer processors, a pair of oneodd RBM and one even RBM, and placing, by the one or more computerprocessors, the pair of RBMs in one or more stacks. It is advantageousto include RBMs trained by both supervised and unsupervised methodsbecause it is an effective method for correlating different types offeatures from multimodal data. Using both supervised and unsupervisedmethods is also advantageous because it enables fine tuning ofunsupervised training with supervised training results.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a functional block diagram illustrating a computationalenvironment, in accordance with an embodiment of the present invention;

FIG. 2 is a flowchart depicting operational steps of a model trainingprogram, on a computer within the computational environment of FIG. 1,for training a cognitive model, in accordance with an embodiment of thepresent invention;

FIG. 3 is a flowchart depicting operational steps of an incidentpredictor program, on the computer within the computational environmentof FIG. 1, for predicting and responding to incidents, in accordancewith an embodiment of the present invention; and

FIG. 4 depicts a block diagram of components of the computer executingthe incident predictor program within the computational environment ofFIG. 1, in accordance with an embodiment of the present invention.

DETAILED DESCRIPTION

Embodiments of the present invention recognize that tangible andintangible damages and losses resulting from a critical incident may beminimized, or eliminated, by implementing a system that aggregates,i.e., collects and combines, data from a plurality of sources, predictsan occurrence of an incident and associated ramifications, and notifiesstakeholders of status and instructions to minimize risk. The aggregateddata may include any type of data corresponding to an incident such as adescription of the incident, the location of the incident, the time ofthe incident, weather conditions in the area of the incident, currentpopulation of the area of the incident, historical accounts of similarincidents, schedules of public transportation and events in the area ofthe incident, status of security systems and personnel, etc. Theaggregated data may include data received from an observer or bystanderof the incident as well as data retrieved from other sources.Embodiments of the present invention further recognize that providing asystem that receives data from observers and bystanders enables theobservers and bystanders to help with an incident according to theirabilities and without fear of being punished for a false alarm becausethe system calculates the probability of an incident. Embodiments of thepresent invention further recognize that providing a system thataggregates data from a plurality of sources minimizes the need forexpensive security monitoring, both by devices and personnel.Embodiments of the present invention may also be used for training ofauthorities and citizens in the assessment and response to criticalincidents. Implementation of embodiments of the invention may take avariety of forms, and exemplary implementation details are discussedsubsequently with reference to the Figures.

FIG. 1 is a functional block diagram illustrating a computationalenvironment, generally designated 100, in accordance with one embodimentof the present invention. FIG. 1 provides only an illustration of oneimplementation and does not imply any limitations with regard to theenvironments in which different embodiments may be implemented. Manymodifications to the depicted environment may be made by those skilledin the art without departing from the scope of the invention as recitedby the claims.

Computational environment 100 includes client computing device(s) 104and computer 114, interconnected over network 102. Network 102 can be,for example, a telecommunications network, a local area network (LAN), awide area network (WAN), such as the Internet, or a combination of thethree, and can include wired, wireless, or fiber optic connections.Network 102 can include one or more wired and/or wireless networks thatare capable of receiving and transmitting data, voice, and/or videosignals, including multimedia signals that include voice, data, andvideo information. In general, network 102 can be any combination ofconnections and protocols that will support communications betweenclient computing device(s) 104, computer 114, and other computingdevices (not shown) within computational environment 100.

Client computing device(s) 104 can be one or more of a laptop computer,a tablet computer, a smart phone, or any programmable electronic devicecapable of communicating with various components and devices withincomputational environment 100, via network 102. Client computingdevice(s) 104 can be a wearable computer. Wearable computers areminiature electronic devices that may be worn by the bearer under, withor on top of clothing, as well as in glasses, hats, or otheraccessories. Wearable computers are especially useful for applicationsthat require more complex computational support than just hardware codedlogics. In general, client computing device(s) 104 represents anyprogrammable electronic device or combination of programmable electronicdevices capable of executing machine readable program instructions andcommunicating with other computing devices (not shown) withincomputational environment 100 via a network, such as network 102. Clientcomputing device(s) 104 includes social network application 106,incident alert application 108, and biometric sensor(s) 110.

Social network application 106 is one or more of a plurality ofplatforms for building online social networks among people who shareinterests, activities, backgrounds, and/or real-life connections. Socialnetwork applications are web-based services that allow individuals tocreate a public or private profile, to create a list of users with whomto share connections, and to view and interact with the connectionswithin the system. Social network applications may also includecommunication tools such as mobile connectivity, photo and videosharing, and blogging.

Incident alert application 108 is software that acts as a user interfacebetween a user of client computing device(s) 104 and incident predictorprogram 116 on computer 114. Incident alert application 108 may be acomputer program designed to permit a user to perform a group ofcoordinated functions, tasks, or activities with respect to incidentpredictor program 116. Incident alert application 108 may be mobileapplication software i.e., an app, which is a computer program typicallydesigned to run on smart phones, tablet computers and other mobiledevices. Incident alert application 108 enables a user to send an alertor a status message regarding a critical incident to incident predictorprogram 116. The advantage of a user being able to send alerts andstatus messages in response to an incident is the user can help with anincident according to the user's abilities. In an embodiment, incidentalert application 108 enables a user to send an alert or status messageanonymously. The advantage of a user being able to send alerts andstatus messages anonymously is the user can send an alert freely,without fear of being punished for a false alarm. Incident alertapplication 108 also enables a user to receive alerts, queries, andinstructions regarding a critical incident from incident predictorprogram 116. The advantage of a user being able to receive alerts,queries, and instructions from incident predictor program 116 is theuser can receive advanced warning of a critical incident and be preparedfor the incident, as well as assist authorities with informationcorresponding to the incident by responding to queries. Critical, asreferred to herein, implies dangerous, harmful, risky, or with thepotential to cause damage or injury to people or property, as well ascrucial or of decisive importance with respect to the outcome. Biometricsensor(s) 110 are one or more of a plurality of sensors designed totrack biometric parameters of an associated user. Biometric parametersinclude, but are not limited to, heart rate, heart rate variability,gait, blood pressure, respiration rate, and oxygen saturation. Biometricsensor(s) 110 may also be able to detect or track a user's physicalcharacteristic, such as height, weight, and age.

Sensor(s) 112 may be one or more transducers whose purpose is to sense,i.e., to detect, some characteristic of its environment. A transducersensor, such as sensor(s) 112, detects events or changes in quantitiesand provides a corresponding output, generally as an electrical oroptical signal. For example, a thermocouple converts temperature to anoutput voltage. Sensor(s) 112 may also be one or more cameras,microphones, or other recording devices that can capture informationregarding a critical incident. In addition, sensor(s) 112 may be weathermonitoring devices, such as thermometers, barometers, and anemometers,as well as seismometers.

Computer 114 can be a standalone computing device, a server computer, acomputational grid, a management server, a web server, a mobilecomputing device, or any other electronic device or computing systemcapable of receiving, sending, and processing data. In otherembodiments, computer 114 can represent a server computing systemutilizing multiple computers as a server system, such as in a cloudcomputing environment. In another embodiment, computer 114 can be alaptop computer, a tablet computer, a netbook computer, a personalcomputer (PC), a desktop computer, a personal digital assistant (PDA), asmart phone, or any programmable electronic device capable ofcommunicating with client computing device(s) 104, sensor(s) 112, andother computing devices (not shown) within computational environment 100via network 102. In another embodiment, computer 114 represents acomputing system utilizing clustered computers and components (e.g.,database server computers, application server computers, etc.) that actas a single pool of seamless resources when accessed withincomputational environment 100. Computer 114 includes incident predictorprogram 116 and database 120. Computer 114 may include internal andexternal hardware components, as depicted and described in furtherdetail with respect to FIG. 4.

Incident predictor program 116 aggregates one or more alerts from one ormore observers of an incident or of a situation that may become acritical incident with information from other sources to evaluate thesituation and recommend appropriate actions. Incident predictor program116 receives alerts and associated metadata from users of incident alertapplication 108. Incident predictor program 116 aggregates associatedalerts with applicable data stored in database 120, and elsewhere, thuscreating incident information. Applicable data may be any informationthat may be of consequence to the incident or to people or property inproximity to the incident. Applicable data may include, but is notlimited to, weather conditions in the area of the incident, currentpopulation of the area of the incident, historical accounts of similarincidents, schedules of public transportation and events in the area ofthe incident, status of security systems and personnel, and the like.Incident predictor program 116 feeds the incident information into acognitive model that can predict probabilities and risks of an incidentoccurring and, if so, possible ramifications. If the predictedprobabilities and risks of the incident exceed a threshold, thenincident predictor program 116 notifies stakeholders. In the depictedembodiment, incident predictor program 116 resides on computer 114. Inanother embodiment, incident predictor program 116 may reside on clientcomputing device(s) 104. In the embodiment, a user of client computingdevice(s) 104 may initiate incident predictor program 116 upon observingan incident. Incident predictor program 116 includes cognitive model118. Incident predictor program 116 is depicted and described in furtherdetail with respect to FIG. 3.

Cognitive model 118 utilizes deep learning techniques and multimodaldata calculate predictions relative to critical incidents. Specifically,cognitive model 118 uses an approach that includes a neuromorphicalgorithm that can be trained with supervised and unsupervised methods.In a preferred embodiment, cognitive model 118 utilizes associatedindependent stacked Restricted Boltzmann Machines (RBM) with bothsupervised and unsupervised methods. This technique is advantageous overconventional techniques because the training is very fast, thus savingtime and computing resources. The technique is also advantageous becauseit requires less training exemplars. In addition, the technique isadvantageous because it is an effective method for correlating differenttypes of features from multimodal data. The technique is alsoadvantageous because it enables fine tuning of unsupervised trainingwith supervised training results. Cognitive model 118 assesses asituation by considering different factors which may be online oroffline and available as structured or unstructured data and applyingrelative weights. A subject matter expert feeds a training set of datato cognitive model 118. In one embodiment, the data is labeled as“critical” or “not critical,” enabling cognitive model 118 to learn whatconstitutes a critical incident or situation during offline training,prior to use. The training set of data includes examples of a pluralityof incidents, likely outcomes of the incidents, and associated risks.Cognitive model 118 is trained to recognize the difference between, forexample, a weather incident and a traffic incident. In addition,cognitive model 118 is trained to recognize the severity of an incident,such as the difference between a thunderstorm and a tornado. Cognitivemodel 118 learns from the training set of data to distinguish betweenlikely and unlikely scenarios. Once trained, cognitive model 118 canassign a weight or probability to the occurrence of a critical incidentbased on the data aggregated by incident predictor program 116.Cognitive model 118 may also assign a weight or probability to risks topeople and/or property associated with an incident, and to the positiveor negative outcome of various actions taken by observers andstakeholders of the incident. The training of cognitive model 118 isdepicted and described in further detail with respect to FIG. 2.

Database 120 resides on computer 114. In another embodiment, database120 can reside anywhere in computational environment 100, provided thatcognitive model 118 has access to database 120. A database is anorganized collection of data. Database 120 can be implemented with anytype of storage device capable of storing data and configuration filesthat can be accessed and utilized by computer 114, such as a databaseserver, a hard disk drive, or a flash memory. Database 120 stores aplurality of data that may be useful in assessing a critical incident.For example, database 120 may store historical weather data. Database120 may also store locations and calibration history of sensor(s) 112.Database 120 may store information regarding upcoming events and publictransportation schedules. Database 120 may also store backgroundinformation of users of incident alert application 108.

FIG. 2 is a flowchart depicting operational steps of model trainingprogram 200, on computer 114 within computational environment 100 ofFIG. 1, for training cognitive model 118, in accordance with anembodiment of the present invention.

Model training program 200 passes a vector into a Restricted BoltzmannMachine (RBM) (step 202). Model training program 200 trains cognitivemodel 118 with both image feature vectors and textual feature vectors,where the vectors originate from feature extractors applied tomultimodal data. In one embodiment, model training program 200 appliesleft sided associated independent stacked RBMs to image feature vectorsand right sided associated independent stacked RBMs to textual featurevectors. The training results in the visible and hidden layers of theRBM learning features within the vector, whether the vector is an imagefeature vector or a textual feature vector.

Model training program 200 determines whether the RBM is odd (decisionblock 204). Model training program 200 utilizes both supervised andunsupervised methods, i.e., multimodal data. The advantage of using bothsupervised and unsupervised methods is because it is an effective methodfor correlating different types of features from multimodal data. Usingboth supervised and unsupervised methods is also advantageous because itenables fine tuning of unsupervised training with supervised trainingresults. In order to equally integrate the training with both supervisedand unsupervised methods, model training program 200 splits the RBMschronologically into odd and even numbering. For example, RBM₁ is oddwhile RBM₂ is even. If the RBM is not odd, i.e., the RBM is even (“no”branch, decision block 204), then model training program 200 trains theRBM with a supervised method based on objects (step 208). As would berecognized by one skilled in the art, supervised learning is the machinelearning task of inferring a function from labeled training data. Thetraining data consists of a set of training examples. In supervisedlearning, each example is a pair consisting of an input object,typically a vector, and a desired output value or target. The goal is tolearn a general rule that maps inputs to outputs. A supervised method isadvantageous because a supervised learning algorithm analyzes thetraining data and produces an inferred function, which can be used formapping new examples.

If the RBM is odd (“yes” branch, decision block 204), then modeltraining program 200 trains the RBM with an unsupervised method. Aswould be recognized by one skilled in the art, an unsupervised methodtries to find hidden structure in unlabeled data and includes analgorithm with no target value, i.e., there is no error or reward signalto evaluate a potential solution. Instead, the algorithm has a haltingcriterion. Examples of halting criteria include, but are not limited to,precision, recall, accuracy, number of cycles, and time. An unsupervisedmethod is advantageous for use in model training when the only dataavailable is unlabeled data.

Responsive to training the RBM with a supervised or an unsupervisedmethod, model training program 200 places the RBM in a stack of RBMs(step 210). Stacking RBMs, as is known in the art, creates a multi-layermodel where output from a first layer becomes input for a layer stackedon top of the first layer. In one embodiment, model training program 200alternates the placement of the even RBMs and the odd RBMs in one stack.In another embodiment, model training program 200 creates a layer with apair of odd and even RBMs. The first RBM trained becomes the first of astack.

Responsive to stacking both odd and even RBMs, model training program200 determines whether the desired recall is obtained (decision block212). Desired recall is a criteria used to determine whether cognitivemodel 118 minimizes the number of missed or mistaken predictions. Modeltraining program 200 tests both supervised and unsupervised RBMs withlabeled data, simulating a real use case. If the desired recall of thetesting is not obtained (“no” branch, decision block 212), then modeltraining program 200 returns to decision block 204 and adds additionalRBMs to cognitive model 118.

If the desired recall of the testing is obtained (“yes” branch, decisionblock 212), then model training program 200 creates associative layersof stacked, labeled RBMs (step 214). Model training program 200 createsassociative layers of two or more stacked RBMs created from imagefeature vectors and also creates associative layers of two or morestacked RBMs created from textual feature vectors. Model trainingprogram 200 creates the associative layers with supervised learningusing labels of opposite meaning. In one embodiment, the labels may be“critical” and “not critical.” Model training program 200 can associateany number of independent RBMs together.

Model training program 200 performs supervised training with theassociative layers (step 216). Model training program 200 takes theoutput from the associative layers of two or more stacked RBMs createdfrom image feature vectors and from the associative layers of two ormore stacked RBMs created from textual feature vectors, using the labels“critical” and “not critical,” to perform supervised training ofcognitive model 118. As would be recognized by one skilled in the art,the supervised training determines the difference between a predictionand a target, i.e., the error, and back propagates the differencethrough the layers such that cognitive model 118 “learns.”

Model training program 200 determines whether the correct precision isobtained (decision block 218). Model training program 200 testscognitive model 118 with simulated data of a real use case to determinewhether the correct precision is obtained. The correct precision isbased on a ground truth, i.e., an answer key, which defines the correctanswer. By determining whether the correct precision is obtained, modeltraining program 200 minimizes the number of times cognitive model 118predicts a false positive result. If the correct precision is notobtained (“no” branch, decision block 218), then model training program200 continues to train cognitive model 118 by returning to step 216. Ifthe correct precision is obtained (“yes” branch, decision block 218),then cognitive model 118 is ready and model training program 200 endsthe training.

FIG. 3 is a flowchart depicting operational steps of incident predictorprogram 116, on computer 114 within computational environment 100 ofFIG. 1, for predicting and responding to incidents, in accordance withan embodiment of the present invention.

Incident predictor program 116 receives one or more alerts andassociated metadata (step 302). When one or more observers sends analert regarding a critical incident, which may be an alarm or a statusmessage that includes or describes the type of incident, via incidentalert application 108 or via a posting on social network application106, incident predictor program 116 receives the alert. For example, auser of client computing device(s) 104 may send an alert, via incidentalert application 108, describing gathering storm clouds which maybecome a tornado. In one embodiment, incident predictor program 116continuously monitors social network application 106 for all userpostings and determines which postings contain information regardingcritical incidents. In the embodiment, incident predictor program 116may analyze text or images or both as part of the determination. Inanother embodiment, social network application 106 may be a specificpage or group where users post information regarding observed orpotential incidents. In a further embodiment, if incident predictorprogram 116 receives only one incident alert, incident predictor program116 may query social network application 106 to determine whetheradditional observers have posted information corresponding to theincident. Incident predictor program 116 also receives any availablemetadata associated with the alert. Metadata associated with an alertmay be, for example, the location of the device from which the observersent the alert, the device identification, the device battery status,identification of the observer or the owner of the device. With theidentification of the observer, additional metadata may includebackground information of the observer, including, but not limited to, ahistory of previously sent alerts or a history of any education ortraining received regarding the type of incident in the alert, includingthe observer's profession. The advantage of receiving a history of theobserver's previous alerts and/or training is that the history mayindicate the quality or reliability of the information included in thealert. For example, if the alert is in reference to a tornado, metadataof the alert may include the fact that the observer is a trainedmeteorologist, and is therefore likely more qualified to providereliable information on a potential tornado incident. In an embodiment,background information of the observer may be stored in database 120. Inaddition, if the observer's device, i.e., client computing device(s)104, includes biometric sensor(s) 110, then the metadata may alsoinclude biometric information about the observer, including, but notlimited to, heart rate, heart rate variability, gait, blood pressure,and respiration. The advantage of receiving biometric information isthat biometric information may indicate the physical state of theobserver which can be an indication of the urgency of the situation inaddition to the reliability of the information. For example, if anobserver has an elevated heart rate, the information the observerprovides may be exaggerated due to the observer's reaction to theincident.

Incident predictor program 116 aggregates the one or more alerts andadditional applicable data into incident information (step 304).Aggregating, as referenced herein, refers to collecting and combiningthe one or more alerts with additional applicable data, the result ofwhich is data referred to as incident information. Incident predictorprogram 116 aggregates the alerts from one or more observers and theassociated metadata with a plurality of other applicable data, stored indatabase 120, which may be useful in assessing a critical incident. Inone embodiment, incident predictor program 116 may also extractapplicable data from additional sources (not shown), via network 102.Applicable data may include, but is not limited to, weather conditionsin the area of the incident, current population of the area of theincident, historical accounts of similar incidents, schedules of publictransportation and events in the area of the incident, status ofsecurity systems and personnel, and the like. The result of theaggregation of data is a corpus of incident information which describesthe critical incident, or the potential of a critical incident, withinformation known at the time incident predictor program 116 receivesthe alerts.

Incident predictor program 116 feeds the incident information intocognitive model 118 (step 306). Cognitive model 118 processes theincident information to evaluate the incident. By assessing eachcomponent of the incident information, utilizing the training set oflabelled data, and assigning weights to the various components, based onthe quality, reliability, and urgency of the data, cognitive model 118characterizes the current state of the incident and calculates aprediction of a likely outcome as well as a course of action. Continuingthe previous example, cognitive model 118 may include the historicalweather data of the area from which the observer sent the alert sent aswell as current weather data, as received from sensor(s) 112, and assigna weight or probability to the occurrence of a tornado at the time andplace from which the alert originated.

Incident predictor program 116 determines the probabilities and risksassociated with the incident (step 308). Via the output of cognitivemodel 118, incident predictor program 116 determines the probability ofa critical incident occurring, or, if the critical incident is inprogress, and the probability of various outcomes. Incident predictorprogram 116 processes the weights and probabilities which cognitivemodel 118 calculated and assigned to the various components of incidentinformation to determine the likelihood of a critical incidentoccurring. Incident predictor program 116 also determines the risks, ifany, to the observers or other people or property in the vicinity of theincident. For example, if incident predictor program 116 determines acritical incident occurring is highly probable, then incident predictorprogram 116 also determines the probability of whether people are atrisk of injury or if property is at risk of damage, depending on thetype of incident and/or the location of the incident. It is advantageousto determine the probabilities and risks associated with the incidentbecause if an incident is low risk, then people need not be alarmed, butif an incident is high risk, then notification can minimize damage topeople or property in the vicinity of the incident.

Incident predictor program 116 determines whether the incidentinformation exceeds a threshold (decision block 310). Incident predictorprogram 116 compares the probabilities and risks determined in step 308to a pre-defined critical threshold for probability and/or risk todetermine whether the incident information supports sending one or morenotifications with respect to the incident. In one embodiment, thepre-defined critical threshold is a percentage, and incident predictorprogram 116 compares probabilities, calculated as a percentage, to thethreshold percentage. In an embodiment, the critical threshold may bedefined based on the type or severity of the incident. For example, ifthe incident is a tornado, with a high probability of damage, then thepre-defined critical threshold will be lower than if the incident is atwo-car collision on a rural road. In another embodiment, the criticalthreshold may be defined based on the location of the incident. Forexample, if the incident is in a crowded city, with possible impact to alarge number of people, then the pre-defined critical threshold will belower than if the incident is in a sparsely populated area. If incidentpredictor program 116 determines the incident information does notexceed the threshold (“no” branch, decision block 310), then incidentpredictor program 116 determines whether additional alerts and/orapplicable data are received (decision block 312). Incident predictorprogram 116 determines whether additional alerts or status messages, andthe associated metadata, are received from observers. In one embodiment,incident predictor program 116 receives additional alerts from the sameor additional observers or authorities, via incident alert application108. In another embodiment, incident predictor program 116 receivesadditional alerts from postings of observers or authorities on socialnetwork application 106. In a further embodiment, incident predictorprogram 116 queries observers or authorities for additional details ofthe incident and receives additional alerts as responses to the queries.

If incident predictor program 116 determines that additional alerts ordata are not received (“no” branch, decision block 312), then incidentpredictor program 116 takes no further action and ends, havingdetermined that there is not sufficient information to supportadditional actions. If incident predictor program 116 determines thatadditional alerts or data are received (“yes” branch, decision block312), then incident predictor program 116 returns to step 304 andaggregates the new data with the previously aggregated incidentinformation. As new alerts and data are received, incident predictorprogram 116 iteratively re-weights the probability of a criticalincident and any weighted alternatives. It is advantageous to receiveadditional alerts and data because adding the additional incidentinformation may cause the incident information to exceed the threshold,and thereby initiate further actions.

If incident predictor program 116 determines the incident informationdoes exceed the threshold (“yes” branch, decision block 310), thenincident predictor program 116 sends a notification (step 314). If,based on the incident information, incident predictor program 116determines a critical incident is imminent or occurring, then incidentpredictor program 116 sends one or more notifications to a plurality ofstakeholders. The advantage of sending a notification to a plurality ofstakeholders is enabling the stakeholders to take appropriate action inresponse to information associated with the incident. Incident predictorprogram 116 may determine the stakeholders based on one or more of aplurality of criteria. In one embodiment, incident predictor program 116may determine the stakeholders based on the type of incident. In anotherembodiment, incident predictor program 116 may determine thestakeholders based on the location of the incident. In one embodiment,users of incident alert application 108 register with incident predictorprogram 116 such that incident predictor program 116 can easilydetermine whether the user is an incident stakeholder, based on theuser's profile or current location. In another embodiment, incidentpredictor program 116 may determine the stakeholders based on a query ofsocial network application 106 or of the Internet. For example, incidentpredictor program 116 may send a notification to security personnel,police, firefighters, ambulance drivers, hospitals, and the like, toalert them of the situation and suggest preparations and/or actions totake. In another example, incident predictor program 116 may send anotification to devices of observers in the area in response to theobservers' alerts and status messages, giving one or morerecommendations of how to proceed. In a further example, incidentpredictor program 116 may send a notification to all residents within adefined radius of the incident, instructing them to be on the lookoutfor the incident or to evacuate the area. In one embodiment, incidentpredictor program 116 sends the notification via social networkapplication 106. In another embodiment, incident predictor program 116sends the notification via incident alert application 108. In a furtherembodiment, incident predictor program 116 may send the notification bysending a voice message to public loud speakers in the area ortriggering an emergency alert broadcast on television and/or cellularnetworks.

FIG. 4 depicts a block diagram of components of computer 114 withincomputational environment 100 of FIG. 1, in accordance with anembodiment of the present invention. It should be appreciated that FIG.4 provides only an illustration of one implementation and does not implyany limitations with regard to the environments in which differentembodiments can be implemented. Many modifications to the depictedenvironment can be made.

Computer 114 can include processor(s) 404, cache 414, memory 406,persistent storage 408, communications unit 410, input/output (I/O)interface(s) 412 and communications fabric 402. Communications fabric402 provides communications between cache 414, memory 406, persistentstorage 408, communications unit 410, and input/output (I/O)interface(s) 412. Communications fabric 402 can be implemented with anyarchitecture designed for passing data and/or control informationbetween processors (such as microprocessors, communications and networkprocessors, etc.), system memory, peripheral devices, and any otherhardware components within a system. For example, communications fabric402 can be implemented with one or more buses.

Memory 406 and persistent storage 408 are computer readable storagemedia. In this embodiment, memory 406 includes random access memory(RAM). In general, memory 406 can include any suitable volatile ornon-volatile computer readable storage media. Cache 414 is a fast memorythat enhances the performance of processor(s) 404 by holding recentlyaccessed data, and data near recently accessed data, from memory 406.

Program instructions and data used to practice embodiments of thepresent invention, e.g., incident predictor program 116, cognitive model118, and database 120 are stored in persistent storage 408 for executionand/or access by one or more of the respective processor(s) 404 ofcomputer 114 via memory 406. In this embodiment, persistent storage 408includes a magnetic hard disk drive. Alternatively, or in addition to amagnetic hard disk drive, persistent storage 408 can include asolid-state hard drive, a semiconductor storage device, a read-onlymemory (ROM), an erasable programmable read-only memory (EPROM), a flashmemory, or any other computer readable storage media that is capable ofstoring program instructions or digital information.

The media used by persistent storage 408 may also be removable. Forexample, a removable hard drive may be used for persistent storage 408.Other examples include optical and magnetic disks, thumb drives, andsmart cards that are inserted into a drive for transfer onto anothercomputer readable storage medium that is also part of persistent storage408.

Communications unit 410, in these examples, provides for communicationswith other data processing systems or devices, including resources ofclient computing device(s) 104 and sensor(s) 112. In these examples,communications unit 410 includes one or more network interface cards.Communications unit 410 may provide communications through the use ofeither or both physical and wireless communications links. Incidentpredictor program 116, cognitive model 118, and database 120 may bedownloaded to persistent storage 408 of computer 114 throughcommunications unit 410.

I/O interface(s) 412 allows for input and output of data with otherdevices that may be connected to computer 114. For example, I/Ointerface(s) 412 may provide a connection to external device(s) 416 suchas a keyboard, a keypad, a touch screen, a microphone, a digital camera,and/or some other suitable input device. External device(s) 416 can alsoinclude portable computer readable storage media such as, for example,thumb drives, portable optical or magnetic disks, and memory cards.Software and data used to practice embodiments of the present invention,e.g., incident predictor program 116, cognitive model 118, and database120 on computer 114, can be stored on such portable computer readablestorage media and can be loaded onto persistent storage 408 via I/Ointerface(s) 412. I/O interface(s) 412 also connect to a display 418.

Display 418 provides a mechanism to display data to a user and may be,for example, a computer monitor. Display 418 can also function as atouchscreen, such as a display of a tablet computer.

The programs described herein are identified based upon the applicationfor which they are implemented in a specific embodiment of theinvention. However, it should be appreciated that any particular programnomenclature herein is used merely for convenience, and thus theinvention should not be limited to use solely in any specificapplication identified and/or implied by such nomenclature.

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium (or media) having computer readable programinstructions thereon for causing a processor to carry out aspects of thepresent invention.

The computer readable storage medium can be any tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++ or the like, andconventional procedural programming languages, such as the “C”programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computeror entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including a local area network (LAN) or a wide areanetwork (WAN), or the connection may be made to an external computer(for example, through the Internet using an Internet Service Provider).In some embodiments, electronic circuitry including, for example,programmable logic circuitry, field-programmable gate arrays (FPGA), orprogrammable logic arrays (PLA) may execute the computer readableprogram instructions by utilizing state information of the computerreadable program instructions to personalize the electronic circuitry,in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, a special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, a segment, or aportion of instructions, which comprises one or more executableinstructions for implementing the specified logical function(s). In somealternative implementations, the functions noted in the blocks may occurout of the order noted in the Figures. For example, two blocks shown insuccession may, in fact, be executed substantially concurrently, or theblocks may sometimes be executed in the reverse order, depending uponthe functionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The descriptions of the various embodiments of the present inventionhave been presented for purposes of illustration, but are not intendedto be exhaustive or limited to the embodiments disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the invention.The terminology used herein was chosen to best explain the principles ofthe embodiment, the practical application or technical improvement overtechnologies found in the marketplace, or to enable others of ordinaryskill in the art to understand the embodiments disclosed herein.

What is claimed is:
 1. A method for incident prediction and response,the method comprising: receiving, by one or more computer processors,one or more alerts corresponding to an incident, wherein the one or morealerts are one or more status messages received from one or moreobservers; aggregating, by the one or more computer processors, the oneor more alerts with additional data corresponding to the incident;feeding, by the one or more computer processors, the aggregated datainto a prediction model, wherein training of the prediction model usesassociated independent stacked Restricted Boltzmann Machines utilizingone or more supervised methods and one or more unsupervised methods;determining, by the one or more computer processors, based, at least inpart, on one or more calculations by the prediction model, at least oneprobability of the incident; determining, by the one or more computerprocessors, whether the at least one probability exceeds a pre-definedthreshold; and responsive to determining the at least one probabilityexceeds a pre-defined threshold; sending, by the one or more computerprocessors, at least one notification.
 2. The method of claim 1, whereinthe at least one probability of the incident includes a probability ofthe incident occurring in the future.
 3. The method of claim 1, whereinthe at least one probability of the incident includes a probability ofone or more outcomes of the incident.
 4. The method of claim 1, whereinthe at least one probability of the incident includes a probability ofone or more risks to people or property associated with the incident. 5.The method of claim 1, wherein the at least one probability of theincident includes a probability of the incident occurring at a time theone or more alerts are received.
 6. The method of claim 1, wherein theat least one probability of the incident includes a probability of theincident becoming of decisive importance with respect to an outcome. 7.The method of claim 1, wherein the one or more alerts include metadatacorresponding to the one or more alerts.
 8. The method of claim 7,wherein metadata corresponding to the one or more alerts includes: alocation of a device from which an observer sends an alert, anidentification of the device, a device battery status, an identificationof an observer of the incident, an identification of an owner of thedevice, a background information of an observer, a history of anobserver's previously sent alerts, a history of an observer's receivededucation associated with a type of incident in the alert, an observer'sprofession, a heart rate, a heart rate variability, a gait, a bloodpressure, a respiration, an oxygen saturation, or a physicalcharacteristic of an observer.
 9. The method of claim 1, whereinadditional data corresponding to the incident includes: a weathercondition in an area of the incident, a current population of an area ofthe incident, one or more historical accounts of similar incidents, oneor more schedules of public transportation in an area of the incident,one or more schedules of one or more events in an area of the incident,a status of security systems corresponding to an area of the incident,or a status of personnel corresponding to an area of the incident. 10.The method of claim 1, wherein the at least one notification includes atleast one of: a probability of an incident occurring, a status of anincident, or instructions for actions to take corresponding to anincident.
 11. A computer program product for incident prediction andresponse, the computer program product comprising: one or more computerreadable storage device and program instructions stored on the one ormore computer readable storage device, the stored program instructionscomprising: program instructions to receive one or more alertscorresponding to an incident, wherein the one or more alerts are statusmessages received from one or more observers; program instructions toaggregate the one or more alerts with additional data corresponding tothe incident; program instructions to feed the aggregated data into aprediction model, wherein training of the prediction model usesassociated independent stacked Restricted Boltzmann Machines utilizingone or more supervised methods and one or more unsupervised methods;program instructions to determine, based, at least in part, on one ormore calculations by the prediction model, at least one probability ofthe incident; program instructions to determine whether the at least oneprobability exceeds a pre-defined threshold; and responsive todetermining the at least one probability exceeds a pre-definedthreshold, program instructions to send at least one notification. 12.The computer program product of claim 11, wherein the one or more alertsinclude metadata corresponding to the one or more alerts.
 13. Thecomputer program product of claim 12, wherein metadata corresponding tothe one or more alerts includes: a location of a device from which anobserver sends an alert, an identification of the device, a devicebattery status, an identification of an observer of the incident, anidentification of an owner of the device, a background information of anobserver, a history of an observer's previously sent alerts, a historyof an observer's received education associated with a type of incidentin the alert, an observer's profession, a heart rate, a heart ratevariability, a gait, a blood pressure, a respiration, an oxygensaturation, or a physical characteristic of an observer.
 14. Thecomputer program product of claim 11, wherein additional datacorresponding to the incident includes: a weather condition in an areaof the incident, a current population of an area of the incident, one ormore historical accounts of similar incidents, one or more schedules ofpublic transportation in an area of the incident, one or more schedulesof one or more events in an area of the incident, a status of securitysystems corresponding to an area of the incident, or a status ofpersonnel corresponding to an area of the incident.
 15. The computerprogram product of claim 11, wherein the at least one notificationincludes at least one of: a probability of an incident occurring, astatus of an incident, or instructions for actions to take correspondingto an incident.
 16. A computer system for incident prediction andresponse, the computer system comprising: one or more computerprocessors; one or more computer readable storage device; programinstructions stored on the one or more computer readable storage devicefor execution by at least one of the one or more computer processors,the stored program instructions comprising: program instructions toreceive one or more alerts corresponding to an incident, wherein the oneor more alerts are status messages received from one or more observers;program instructions to aggregate the one or more alerts with additionaldata corresponding to the incident; program instructions to feed theaggregated data into a prediction model, wherein training of theprediction model uses associated independent stacked RestrictedBoltzmann Machines utilizing one or more supervised methods and one ormore unsupervised methods; program instructions to determine, based, atleast in part, on one or more calculations by the prediction model, atleast one probability of the incident; program instructions to determinewhether the at least one probability exceeds a pre-defined threshold;and responsive to determining the at least one probability exceeds apre-defined threshold, program instructions to send at least onenotification.
 17. The computer system of claim 16, wherein the one ormore alerts include metadata corresponding to the one or more alerts.18. The computer system of claim 17, wherein metadata corresponding tothe one or more alerts includes: a location of a device from which anobserver sends an alert, an identification of the device, a devicebattery status, an identification of an observer of the incident, anidentification of an owner of the device, a background information of anobserver, a history of an observer's previously sent alerts, a historyof an observer's received education associated with a type of incidentin the alert, an observer's profession, a heart rate, a heart ratevariability, a gait, a blood pressure, a respiration, an oxygensaturation, or a physical characteristic of an observer.
 19. Thecomputer system of claim 16, wherein additional data corresponding tothe incident includes: a weather condition in an area of the incident, acurrent population of an area of the incident, one or more historicalaccounts of similar incidents, one or more schedules of publictransportation in an area of the incident, one or more schedules of oneor more events in an area of the incident, a status of security systemscorresponding to an area of the incident, or a status of personnelcorresponding to an area of the incident.
 20. The computer system ofclaim 16, wherein the at least one notification includes at least oneof: a probability of an incident occurring, a status of an incident, orinstructions for actions to take corresponding to an incident.